Microsoft IIS 5.0 .printer ISAPI Extension Buffer Overflow Vulnerability
BID:2674
Info
Microsoft IIS 5.0 .printer ISAPI Extension Buffer Overflow Vulnerability
| Bugtraq ID: | 2674 |
| Class: | Boundary Condition Error |
| CVE: | |
| Remote: | Yes |
| Local: | No |
| Published: | May 01 2001 12:00AM |
| Updated: | May 01 2001 12:00AM |
| Credit: | Discovered by Riley Hassel of eEye Digital Security and posted in a Microsoft Security Bulletin MS01-023 on May 1, 2001. |
| Vulnerable: |
Microsoft IIS 5.0 |
| Not Vulnerable: | |
Discussion
Microsoft IIS 5.0 .printer ISAPI Extension Buffer Overflow Vulnerability
Windows 2000 Internet printing ISAPI extension contains msw3prt.dll which handles user requests. Due to an unchecked buffer in msw3prt.dll, a maliciously crafted HTTP .printer request containing approx 420 bytes in the 'Host:' field will allow the execution of arbitrary code. Typically a web server would stop responding in a buffer overflow condition; however, once Windows 2000 detects an unresponsive web server it automatically performs a restart. Therefore, the administrator will be unaware of this attack.
* If Web-based Printing has been configured in group policy, attempts to disable or unmap the affected extension via Internet Services Manager will be overridden by the group policy settings.
Windows 2000 Internet printing ISAPI extension contains msw3prt.dll which handles user requests. Due to an unchecked buffer in msw3prt.dll, a maliciously crafted HTTP .printer request containing approx 420 bytes in the 'Host:' field will allow the execution of arbitrary code. Typically a web server would stop responding in a buffer overflow condition; however, once Windows 2000 detects an unresponsive web server it automatically performs a restart. Therefore, the administrator will be unaware of this attack.
* If Web-based Printing has been configured in group policy, attempts to disable or unmap the affected extension via Internet Services Manager will be overridden by the group policy settings.
Exploit / POC
Microsoft IIS 5.0 .printer ISAPI Extension Buffer Overflow Vulnerability
CORE has developed a working commercial exploit for their IMPACT product. This exploit is not otherwise publicly available or known to be circulating in the wild.
Ryan Permeh of eEye Digital Security released the following 'iishack2000.c' exploit.
Wanderley J. Abreu Jr. <[email protected]> has provided the following memory leak 'iiswebexplt.pl' exploit.
dark spyrit <[email protected]> has provided the following 'jill.c' exploit.
Cyrus The Great <[email protected]> has provided the following 'iis5hack.zip' exploit.
The exploits provided may not work on Japanese version of IIS. This does not necessarily mean Japanese IIS is not vulnerable.
An exploit has been released as part of the MetaSploit Framework 2.0.
Exploit code has also been provided by sectroyer <[email protected]>.
Proof of concept iis_printer_bof.c was provided by Daniele Spaccini (styx^) <[email protected]>.
CORE has developed a working commercial exploit for their IMPACT product. This exploit is not otherwise publicly available or known to be circulating in the wild.
Ryan Permeh of eEye Digital Security released the following 'iishack2000.c' exploit.
Wanderley J. Abreu Jr. <[email protected]> has provided the following memory leak 'iiswebexplt.pl' exploit.
dark spyrit <[email protected]> has provided the following 'jill.c' exploit.
Cyrus The Great <[email protected]> has provided the following 'iis5hack.zip' exploit.
The exploits provided may not work on Japanese version of IIS. This does not necessarily mean Japanese IIS is not vulnerable.
An exploit has been released as part of the MetaSploit Framework 2.0.
Exploit code has also been provided by sectroyer <[email protected]>.
Proof of concept iis_printer_bof.c was provided by Daniele Spaccini (styx^) <[email protected]>.
- /data/vulnerabilities/exploits/iishack2000.c
- /data/vulnerabilities/exploits/jill.c
- /data/vulnerabilities/exploits/iiswebexplt.pl
- /data/vulnerabilities/exploits/iis5hack.zip
- /data/vulnerabilities/exploits/iis50_printer_overflow.pm
- /data/vulnerabilities/exploits/sol2k.c
- /data/vulnerabilities/exploits/iis_printer_bof.c
Solution / Fix
Microsoft IIS 5.0 .printer ISAPI Extension Buffer Overflow Vulnerability
Solution:
Microsoft has released a patch which rectifies this issue. Patches for Windows 2000 Datacenter Server are hardware-specific and available from the original equipment manufacturer.
Microsoft IIS 5.0
Solution:
Microsoft has released a patch which rectifies this issue. Patches for Windows 2000 Datacenter Server are hardware-specific and available from the original equipment manufacturer.
Microsoft IIS 5.0
References
Microsoft IIS 5.0 .printer ISAPI Extension Buffer Overflow Vulnerability
References:
References:
- IIS Printer exploit (CORE Security)
- Microsoft Security Bulletin MS01-023 (Microsoft)
- Windows 2000 IIS 5.0 Remote buffer overflow vulnerability (Remote SYSTEM Level A (eEye Digital Security)